Secure Configuration
Secure Configuration
vRealize Operations Security Posture
Secure Deployment of vRealize Operations
Verify the Integrity of Installation Media
How to Verify the Integrity of vRealize Operations Upgrade Pak Files Either from Trusted or Untrusted Sources
Hardening the Deployed Software Infrastructure
Hardening the VMware vSphere Environment
Reviewing Installed and Unsupported Software
Verify Third-Party Software
VMware Security Advisories and Patches
Secure Configuration of vRealize Operations
Activating FIPS 140-2
Secure the vRealize Operations Console
Change the Root Password
Manage Password Expiry
Managing Secure Shell, Administrative Accounts, and Console Access
Activate or Deactivate Secure Shell on a vRealize Operations Node
Create a Local Administrative Account for Secure Shell
Restrict Secure Shell Access
Maintain Secure Shell Key File Permissions
Harden the Secure Shell Server Configuration
Harden the Secure Shell Client Configuration
Deactivate Direct Logins as Root
Deactivate SSH Access for the Admin User Account
Set Boot Loader Authentication
Monitor Minimal Necessary User Accounts
Monitor Minimal Necessary Groups
Resetting the vRealize Operations Manager Administrator Password
Configure NTP on vRealize Operations
Deactivate the TCP Timestamp Response on Linux
TLS for Data in Transit
Configure Strong Protocols for vRealize Operations
Verify the Correct Use of Protocols in Apache HTTPD
Verify the Correct Use of Protocols in the GemFire TLS Handler
Configure vRealize Operations to Use Strong Ciphers
Verify the Correct Use of Cipher Suites in Apache HTTPD
Verify the Correct Use of Cipher Suites in GemFire TLS Handler
Activating TLS on Localhost Connections
Generate or Provide Your Own Self-Signed Certificate with OpenSSL
Install the Certificate for PostgreSQL
Activate TLS on PostgreSQL
Application Resources That Must be Protected
Apache Configuration
Deactivate Web Directory Browsing
Verify Server Tokens for the Apache2 Server
Deactivate the Trace Method for the Apache2 Server
Deactivate Configuration Modes
Managing Nonessential Software Components
Secure the USB Mass Storage Handler
Secure the Bluetooth Protocol Handler
Secure the Stream Control Transmission Protocol
Secure the Datagram Congestion Control Protocol
Secure Reliable Datagram Sockets Protocol
Secure the Transparent Inter-Process Communication Protocol
Secure Internet Packet Exchange Protocol
Secure AppleTalk Protocol
Secure DECnet Protocol
Secure Firewire Module
Kernel Message Logging
Additional Secure Configuration Activities
Deactivating Unnecessary Ports and Services
Network Security and Secure Communication
Configuring Network Settings for Virtual Application Installation
Set the Queue Size for TCP Backlog
Deny ICMPv4 Echoes to Broadcast Address
Configure the Host System to Deactivate IPv4 Proxy ARP
Configure the Host System to Ignore IPv4 ICMP Redirect Messages
Configure the Host System to Ignore IPv6 ICMP Redirect Messages
Configure the Host System to Deny IPv4 ICMP Redirects
Configure the Host System to Log IPv4 Martian Packets
Configure the Host System to use IPv4 Reverse Path Filtering
Configure the Host System to Deny IPv4 Forwarding
Configure the Host System to Deny Forwarding of IPv4 Source Routed Packets
Configure the Host System to Deny IPv6 Forwarding
Configure the Host System to Use IPv4 TCP SYN Cookies
Configure the Host System to Deny IPv6 Router Advertisements
Configure the Host System to Deny IPv6 Router Solicitations
Configure the Host System to Deny IPv6 Router Preference in Router Solicitations
Configure the Host System to Deny IPv6 Router Prefix
Configure the Host System to Deny IPv6 Router Advertisement Hop Limit Settings
Configure the Host System to Deny IPv6 Router Advertisement Autoconf Settings
Configure the Host System to Deny IPv6 Neighbor Solicitations
Configure the Host System to Restrict IPv6 Maximum Addresses
Configuring Ports and Protocols
Minimum Default Incoming Ports
Cipher Suites and Protocols
Cipher Suites When FIPS is On
Cipher Suites When FIPS is Off
Auditing and Logging on your vRealize Operations System
Securing the Remote Logging Server
Use an Authorized NTP Server
Client Browser Considerations